Function plan_security_updates 

pub async fn plan_security_updates(
    analysis: &ManifestAnalysis,
    ecosystem: &dyn Ecosystem,
    osv: &OsvClient,
    package_filter: &[String],
    ignore_rules: &IgnoreRules,
    fetch_timeout_secs: u64,
) -> UpdatePlan

Plans the --security-only update set.

Every OSV-Vulnerable dependency, targeting recommended_fix(), independently re-verified against OSV before being classified Applied/RequiresLockfileUpdate/Unfixable.

ignore_rules is consulted only for reporting which rule was overridden (FR-008) — never to suppress a candidate; pass IgnoreRules::empty when no --config was given, same as the default planner.

Examples

With no OSV scan having run (analysis.vulnerabilities is None — --security-only was combined with network.offline/vulnerabilities_enabled = false, or simply never executed against this manifest), this returns an empty plan without ever touching osv, so this example runs deterministically with no network access:

use deps_cli::analyze::ManifestAnalysis;
use deps_cli::update::ignore::IgnoreRules;
use deps_cli::update::security::plan_security_updates;
use deps_core::osv::OsvClient;
use deps_core::{EcosystemId, HttpCache};
use deps_engine::test_util::TestTier3Ecosystem;
use std::collections::{HashMap, HashSet};
use std::sync::Arc;

let ecosystem = TestTier3Ecosystem::returning(vec![]);
let osv = OsvClient::new(Arc::new(HttpCache::new()));

let analysis = ManifestAnalysis {
    parse_result: deps_core::test_util::stub_parse_result_with_dependencies(0),
    uri: deps_core::test_util::test_uri("/test/pubspec.yaml"),
    now: deps_core::PublishTime::now(),
    ecosystem_id: EcosystemId::Dart,
    cached_versions: HashMap::new(),
    resolved_versions: HashMap::new(),
    resolved_version_candidates: HashMap::new(),
    outcomes: deps_core::lsp_helpers::DependencyOutcomes::new(),
    vulnerabilities: None,
    latest_status: None,
    fallback_status: None,
    cooldown_fallback_view: None,
    gossip_findings: HashMap::new(),
    licenses: HashMap::new(),
    license_policy: deps_core::licenses::LicensePolicy::default(),
    license_source: deps_core::LicenseSource::default(),
    network: deps_core::NetworkMode::Online,
    fetch_failed: HashSet::new(),
    registry_unreachable: false,
    license_fetch_incomplete: false,
};

let plan = plan_security_updates(
    &analysis,
    &ecosystem,
    &osv,
    &[],
    &IgnoreRules::empty(),
    30,
)
.await;

assert!(plan.items.is_empty());